9.4. Configuration Examples
9.4.1. MySQL Changing Database Location
When using Red Hat Enterprise Linux 6, the default location for MySQL to store its database is
/var/lib/mysql/. This is where SELinux expects it to be by default, and hence this area is already labeled appropriately for you, using the
The location where the database is stored can be changed depending on individual environment requirements or preferences, however it is important that SELinux is aware of this new location; that it is labeled accordingly. This example explains how to change the location of a MySQL database and then how to label the new location so that SELinux can still provide its protection mechanisms to the new area based on its contents.
Note that this is an example only and demonstrates how SELinux can affect MySQL. Comprehensive documentation of MySQL is beyond the scope of this document. Refer to the official MySQL documentation for further details. This example assumes that the mysql-server and setroubleshoot-server packages are installed, that the
auditdservice is running, and that there is a valid database in the default location of
- Run the
ls -lZ /var/lib/mysqlcommand to view the SELinux context of the default database location for
ls -lZ /var/lib/mysqldrwx------. mysql mysql unconfined_u:object_r:mysqld_db_t:s0 mysqlThis shows
mysqld_db_twhich is the default context element for the location of database files. This context will have to be manually applied to the new database location that will be used in this example in order for it to function properly.
mysqlshow -u root -pand enter the
mysqldroot password to show the available databases:
mysqlshow -u root -pEnter password: ******* +--------------------+ | Databases | +--------------------+ | information_schema | | mysql | | test | | wikidb | +--------------------+
- Shut down the
mysqlddaemon with the
service mysqld stopcommand as the root user:
service mysqld stopStopping MySQL: [ OK ]
- Create a new directory for the new location of the database(s). In this example,
mkdir -p /mysql
- Copy the database files from the old location to the new location:
cp -R /var/lib/mysql/* /mysql/
- Change the ownership of this location to allow access by the mysql user and group. This sets the traditional Unix permissions which SELinux will still observe.
chown -R mysql:mysql /mysql
- Run the
ls -lZ /optcommand to see the initial context of the new directory:
ls -lZ /optdrwxr-xr-x. mysql mysql unconfined_u:object_r:usr_t:s0 mysqlThe context
usr_tof this newly created directory is not currently suitable to SELinux as a location for MySQL database files. Once the context has been changed, MySQL will be able to function properly in this area.
- Open the main MySQL configuration file
/etc/my.cnfwith a text editor and modify the
datadiroption so that it refers to the new location. In this example the value that should be entered is
[mysqld] datadir=/mysqlSave this file and exit.
- Run the
service mysqld startcommand as the root user to start
mysqld. The service should fail to start, and a denial will be logged to the
/var/log/messagesfile. However, if the
auditdaemon is running alongside the
setroubleshootservice, the denial will be logged to the
SELinux is preventing /usr/libexec/mysqld "write" access on /mysql. For complete SELinux messages. run sealert -l b3f01aff-7fa6-4ebe-ad46-abaef6f8ad71The reason for this denial is that
/mysql/is not labeled correctly for MySQL data files. SELinux is stopping MySQL from having access to the content labeled as
usr_t. Perform the following steps to resolve this problem:
- Run the following
semanagecommand to add a context mapping for
/mysql. Note that
semanageis not installed by default. If it is missing on your system, install the policycoreutils-python package.
semanage fcontext -a -t mysqld_db_t "/mysql(/.*)?"
- This mapping is written to the
grep -i mysql /etc/selinux/targeted/contexts/files/file_contexts.local/mysql(/.*)? system_u:object_r:mysqld_db_t:s0
- Now use the
restoreconcommand to apply this context mapping to the running system:
restorecon -R -v /mysql
- Now that the
/mysql/location has been labeled with the correct context for MySQL, the
service mysqld startStarting MySQL: [ OK ]
- Confirm the context has changed for
ls -lZ /optdrwxr-xr-x. mysql mysql system_u:object_r:mysqld_db_t:s0 mysql
- The location has been changed and labeled, and the
mysqlddaemon has started successfully. At this point all running services should be tested to confirm normal operation.